bugfix: clipbucket security fix unpacks into named directory